Envoy

v1.36.11Networking & Messaging

Oct 1, 2026

A security-focused maintenance release fixes a remotely exploitable TLS denial-of-service issue in `BoringSSL`. Debian 11 packaging is no longer shipped, and the FIPS build remains unpatched for the TLS issue.

Action needed (2)

securitymediumCVE-2026-35189 fixed in BoringSSL
BoringSSL is patched to prevent excessive memory allocation when parsing certificates with nameRelativeToCRLIssuer CRL Distribution Points, which could enable remote denial of service during TLS handshakes. The FIPS build is not patched for this issue.
CVE-2026-35189
breakingDebian bullseye (11) packaging removed
Packaging for Debian bullseye (11) was removed because the release is end-of-life and its repositories are no longer available on the main Debian mirrors.

Add Envoy to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →

Official release note ↗All Envoy releases →